Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Extend finite fields into the future in conjunction with the predict command

$
0
0
I'm attempting to build out a capacity chart that shows total elements used in a system and predicts the future count of elements. My basic search is: index=foo sourcetype=bar |eval capacity=250000 |eval threshold=200000 |timechart span=1d max(capacity), max(threshold), sum(elements) as current |predict currant as Forecast future_timespan=90 The search itself works great - the only issue is that capacity and threshold lines stop at today's date. Is there a way to extend those lines without having to manually specify an extension of 90 days in the timerange? Manually specifiying a date 90 days in the future seems to distort the display of the upper and lower 90 predictions.

Viewing all articles
Browse latest Browse all 47296

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>